[keycloak-user] SAML client brokering to a SAML provider

Hi all, I'm trying to configure a client with SAML that authenticates in a keycloak provider going through a keycloak broker (keycloak provider and keycloak broker are in the same server in different realms). Client is a wildfly 11 using the keycloak-SAML adapter. Broker and provider are using keycloak 4.1.0. I have achieved an OIDC client connecting through the broker to the SAML provider, but I'm not able to do it with a SAML client. In the client, I have this configuration in the wildfly standalone.xml: <secure-deployment name="TestClientKeyCloakSAML.war"> <SP entityID="Broker" sslPolicy="EXTERNAL" logoutPage=" http://localhost:8280/auth/realms/Broker/protocol/saml"> <Keys> <Key signing="true"> <PrivateKeyPem></PrivateKeyPem> <CertificatePem></CertificatePem> </Key> </Keys> <IDP entityID="idp" signatureAlgorithm="RSA_SHA256" signatureCanonicalizationMethod="http://www.w3.org/2001/10/xml-exc-c... <SingleSignOnService signRequest="true" validateResponseSignature="true" validateAssertionSignature="false" requestBinding="POST" bindingUrl=" http://localhost:8280/auth/realms/Broker/protocol/saml"/> <SingleLogoutService validateRequestSignature="true" validateResponseSignature="true" signRequest="true" signResponse="true" requestBinding="POST" responseBinding="POST" postBindingUrl=" http://localhost:8280/auth/realms/Broker/protocol/saml" redirectBindingUrl=" http://localhost:8280/auth/realms/Broker/protocol/saml"/> </IDP> </SP> </secure-deployment> The Identity Provider in the broker realm has this configuration: -SSO service URL: http://localhost:8180/auth/realms/Athens/protocol/saml And the SAML client has this configuration: -Client ID: http://localhost:8280/auth/realms/Broker -Client Protocol: SAML -Master SAML processing URL: http://localhost:8080/TestClientKeyCloakSAML/saml If we login from the client, we can go trough the broker and login in the provider, but the response from the provider arrives to the broker and returns this error: 10:22:00,529 WARN [org.keycloak.protocol.saml.SamlService] (default task-20) Unknown saml response. 10:22:00,529 WARN [org.keycloak.protocol.saml.SamlService] (default task-20) UserSession is not tagged as logging out. 10:22:00,529 WARN [org.keycloak.events] (default task-20) type=LOGOUT_ERROR, realmId=Broker, clientId=null, userId=null, ipAddress=127.0.0.1, error=invalid_logout_response The problem is that the response is arriving to SAMLService.BindingProtocol.handleSamlResponse and it seems that that method only handles logout responses. What is the configuration needed to authenticate a SAML client through a broker to a SAML provider? Thanks! Victor.